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REMARKS 

This paper is responsive to the Office action mailed on January 12, 2007. Favorable 
reconsideration is requested. 

Claims 1-62 are in the application. Claims 1, 3-8, 19, 26-28, 33, 39, 50, 51, and 62 have been 
amended in this response. No new matter has been added. 

First Rejection of Office Action 

Claims 27 and 62 are rejected under 35 U.S.C §112, first paragraph, as failing to comply with 
the written description requirement. This rejection is respectfully traversed. 

The examiner has stated that In claim 27 and 62, the amended 'hardware processor 
accelerating a protocol processing stack' is not disclosed on page 25 of the specification, as 
pointed out in the response by the applicant'. 

Applicant's response referred to in the Examiner's statement above does not refer to page 25 of 
the specification as the examiner asserts, as explained below. 

Applicant's response of October 19, 2006 stated on page 20 paragraph 5 that: "In addition, in 
discussing the amendment to Claim 27 in this response, the Examiner raised a question about 
where the term 'accelerating' appears in the specification as filed. Applicant's position on this is 
set forth on page 25 BELOW. It appears that the Examiner may have mistakenly read this line 
to mean that the amended claim matter appears on page 25 of the specification whereas 
applicant's response just pointed out the page number of the response (stated as "page 25 
below") where the discussion of the amended claim appeared in the response to clearly 
communicate its description in the specification to reasonably convey to one skilled in the 
relevant art that the inventor, at the time the application was filed, had possession of the 
claimed invention. The section of the previous response filed on October 19, 2006, which 
clearly pointed out the sections of the specification where the amended claim matter appears is 
quoted from Oct. 19, 2006 response below. However, these claims have been further amended 
in this response as discussed below the quote from the previous response. 
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The quote from the referred-to page 25 of the Oct. 19, 2006 response that showed the amended 
claim matter in specification in clear and concise terms to reasonably convey that applicant had 
the possession of the claimed invention at the time of the filing of the application follows: 

Begin Quote from Page 25 of the October 19, 2006 Response: 

"Claim 27 has been amended to substitute 'accelerating' for 
'providing'. That is, the hardware processor of Applicant's 
invention accelerates the protocol processing stack as indicated in 
the first two paragraphs of Applicant's 'Summary of the Invention.' 
To the extent that Williams teaches a protocol processing stack, 
Williams does not teach accelerating the protocol processing 
stack. Indeed, the word 'accelerating' does not even appear in 
Williams, because Williams does not recognize the benefits of 
accelerating a protocol processing stack. 

In this regard, the term 'accelerate' and its various other forms 
such as 'accelerator 1 , 'acceleration', and 'accelerated' appear at a 
number of places in this application as originally filed, and these 
terms are used in precisely the way 'accelerating' is used in claim 
27 as amended. 

For example, page 2, line 5 states that 'new hardware solutions 
would accelerate the TCP/IP stack to carry storage and network 
data traffic. . . ' Applicant's invention is one of those solutions that 
would 'accelerate' the TCP/IP stack. 

Page 16, line 30 to page 17, line 5 also indicates that the 
architecture described in this patent can be used for high 
performance TCP/IP and also that the TCP/IP engine can be 
augmented with application specific packet accelerators to 
leverage the architecture, and gives examples as to how this 
might be done. 

Likewise, page 17, lines 19-20 states that 'New hardware 
solutions will accelerate the TCP/IP stack to carry storage and 
network traffic and be competitive to PC based solutions. ' Thus, 
again, acceleration is taught in the instant application as originally 
filed. 

Finally, teaching of acceleration in accordance with this 
application is seen at page 18, lines 24-25: 'The storage protocol, 
like iSCSI, can be built in software running on the host processor 
or may, as described in this patent, be accelerated using 
hardware. ' 
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Accordingly, Williams does not explicitly teach, disclose, or 
illustrate each and every element of claim 27. Specifically, 
Williams does not teach accelerating a protocol processing stack. 
Further, if each element of claim 27, specifically, accelerating a 
protocol processing stack, is considered by the Examiner to be 
inherent in Williams, Applicant respectfully requests the 
introduction of extrinsic evidence clearly showing that the omitted 
material is necessarily present in Williams and that it would be so 
recognized by persons of ordinary skill. In this regard, see In re 
Robertson, 49 USPQ2d 1949 (Fed. Cir. 1999). Alternatively, the 
Applicant respectfully requests withdrawal of this rejection. " 

End of Quote from the October 19, 2006 Response. 

The above clarifies that the "page 25" referred to by the examiner is page 25 of the previous 
response filed October 19, 2006, not page 25 of the specification of this application. Therefore 
applicant requests the examiner to withdraw the above rejection. 

Discussion of Further Amendment of Claims 27 and 62 in this Response 

Claims 27 and 62 have been amended to substitute "accelerating" with "offloading or 
accelerating or sharply reducing overhead of. That is, the hardware processor of applicant's 
invention offloads or sharply reduces overhead of or accelerates the protocol processing stack 
from a host processor as indicated in lines 20-25 of page 2 of the specification in the section 
"Summary of the Invention", lines 24-28 of page 61 through lines 1-2 of page 62, lines 10-11 of 
page 8, lines 16-20 of page 13, lines 10-15 of page 14, lines 20-22 and lines 30-32 of page 16 
through lines 1-5 of page 17, lines 17-23 of page 20, lines 18-20 of page 17, as well as lines 18- 
32 of page 18. The claims have been further amended by adding the term "distributed 
network" to signify the distributed network security system described in this patent titled "A 
distributed network security system and a hardware processor thereof which may be 
appreciated to be clear and concise by any person skilled in the art and may be appreciated by 
the examiner. 

Claims 27 and 62 have been further amended from "said network comprising one or 
more networked systems" to "said network comprising distributed security systems and 
one or more networked systems, said distributed security systems each comprising at 
least one host processor". That is, the network that is being secured by applicant's invention 
of distributed network security system comprises of distributed security systems along with other 
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networked systems instead of a single security system securing an internal network from 
attacks from an external network as described on page 2 lines 8-18, page 4 line 31 through, 
page 6 line 22, page 61 line 13 through page 63 line 23 and page 12 lines 6-29 in clear, concise 
and exact terms as may be appreciated by a person with ordinary skill in the art. 

Accordingly, applicant respectfully requests withdrawal of this rejection. 

Second Rejection of Office Action 

Claims 1-50, and 52-62 have been rejected as anticipated by U.S. Patent No. US 
7,047,561 B1 ("Lee"). That rejection is respectfully traversed for the failure of Lee to include all 
elements and limitations of the rejected claims. 

Axiomatically, rejection of a claim for anticipation by a reference requires that the 
reference contain, explicitly or inherently, all of the steps (or elements) and limitations of the 
rejected claim. 

Independent Claims 9, 34, 40, 45, 55, 58: 

Regarding the above independent claims, each claim requires as part of a combination 
that the security system provide remote direct memory access capability stated as: "a 
plurality of said one or more networked systems comprising a hardware processor providing 
remote direct memory access capability" or stated as: "a plurality of said one or more 
networked systems comprising a remote direct memory access capability for performing 
RDMA data transfers". 

Nowhere in Lee is a 'remote direct memory access capability" described or 
suggested. 

The Examiner has stated that Lee "further discloses DMA controller 208 located in 
firewall 200 (see fig.4; remote direct memory access for data transfer; col. 8, lines 4-10);". The 
applicant agrees with the Examiner that Lee lists DMA controller, 208 located in firewall 200. 
Even though Lee does not describe DMA controller, it is a well understood component of 
modern computers for over twenty years that allows components inside one computer like a 
hard disk drive or a graphics card or a network card or the like to read/write data from/to system 
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memory or other memory within the same computer system without involving the host processor 
of that system, like processor 204 of Lee. Applicant's invention also illustrates DMA engine 
(controller) and DMA operation in several places in the specification like on page 29 lines 12-15, 
page 35 lines 4-8, page 41 lines 25-30 and page 48 line 30 through page 49 line 3. However, 
applicant does not claim DMA controller or DMA operation in these claims. Applicant's claims 
are towards Remote Direct Memory Access. Remote direct memory access capability of the 
applicant's invention is described in the application on page 20 line 6 through page 21 line 5 in 
clear, concise and exact terms as may be appreciated by any person with ordinary skill in the 
art. Applicant's Remote Direct Memory Access capability described on page 20 line 6 
through page 21 line 5, allows an application running on an initiator [one system] or target 
[second system] system to register a region of memory and make it available to its peer(s) 
system [i.e target or initiator system respectively] for access directly using the NIC/HBA 
(Network Interface Card or Host Bus Adapter) without substantial intervention from the host 
processors of the systems. The source or the initiator system, would inform its peer system of 
its desire to read or write specific RDMA enabled buffers and then let the destination or the peer 
system push or pull the data to/from its RDMA buffers. The initiator and the target NIC/HBA 
would then transport the data using the TCP/IP hardware described in applicant's invention 
between each other using internet protocol (IP) without substantial intervention of the host 
processors of the initiator and target systems, thereby significantly reducing the processor 
overhead. Applicant's RDMA allows the systems to be secure and prevent unauthorized access 
as described on page 20 lines 25 through lines 33. Hence it would be clear to one with ordinary 
skill in the art that while DMA controller is used to read or write from one memory to another 
memory within one computer system , an RDMA mechanism is used to transfer data 
between two separate systems which may be located across the world from each other over a 
network without substantial involvement of the host processors of either of the systems involved 
in RDMA data transfer. Hence, applicant asserts that col. 8, line 4-10, as pointed out by the 
Examiner does not describe or even suggest Remote Direct Memory Access ("RDMA"). 

Accordingly, Lee does not explicitly teach, disclose, or illustrate the ' Remote Direct 
Memory Access Capability" element of the applicant's claims. Instead, Lee lists only a DMA 
controller which has been a standard component in modern computers for a long time and is a 
very different matter altogether from applicant's Remote Direct Memory Access capability. 
Further, if this Remote Direct Memory Access Capability element is considered by the Examiner 
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to be inherent in Lee, applicant respectfully requests the introduction of extrinsic evidence 
clearly showing that the omitted material is necessarily present in Lee and that it would be so 
recognized by persons of ordinary skill. In this regard, see In re Robertson , 49 USPQ2d 1949 
(Fed. Cir. 1999). Alternatively, applicant respectfully requests withdrawal of this rejection. 

Claims 10-16, 18, 35-38, 41-44, 46-49, 56, 57, 59, and 60, depending from allowable 
claims 9, 34, 40, 45, 55, 58, are also allowable for the same reasons stated above. 

Applicant can also provide detailed description on various other elements of the claims 
that are also not taught, disclosed or illustrated by Lee if the Examiner requires it. 

Independent Claims 2, 31, 52: 

Regarding the above independent claims, each claim requires as part of a combination 
that: a) the security system is for a storage area network and b) the security system provide 
multiple protocol layer security in storage area network stated as: "A security system for a 
storage area network" and "said security system providing multiple protocol layer security 
in said storage area network" respectively. 

Nowhere in Lee is a security system for a storage area network described or 
suggested. Further, nowhere in Lee is a security system providing multiple protocol layer 
security in a storage area network described or suggested. 

The Examiner has stated that Lee "further discloses DMA controller 208 located in 
firewall 200 (see fig.4; remote direct memory access for data transfer; col. 8, lines 4-10); and 
RAM 206 (storage area network for one or more network system). See col. 8, lines 4-10". The 
applicant agrees with the Examiner that Lee lists RAM Memory, 206. RAM memory is a random 
access memory in a computer system as is well understood by any person with ordinary skill in 
the art. Applicant's application also describes RAM memory in several places like page 25 line 
21 through 26, page 34 line 27-33, page 35 lines 19-21, and page 44 lines 11 through page 45 
line 14. However, applicant does not claim RAM in these claims but applicant's claims are 
towards a Storage Area Network. Applicant's invention clearly and concisely describes a 
storage area network and a security system for a storage area network on page 62 lines 21-30, 
and lines 1 1-23 of page 63 respectively as may be appreciated by any person of ordinary skill in 
the art. Thus it is clear that a RAM (random access memory) is completely different than a 
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network of storage devices connected to an array of servers or clients or the like in a Storage 
Area Network (SAN) as described in applicant's patent application as discussed above. Hence, 
applicant asserts that col. 8, line 4-10, as pointed out by the Examiner does not describe or 
even suggest a storage area network leave alone a security system for a storage area network. 
In fact, Lee does not even recognize the need or benefits of a storage area network and 
nowhere does Lee teach or suggest a security system for a storage area network. 

Accordingly, Lee does not explicitly teach, disclose, or illustrate either a " A security 
system for a storage area network ' element of applicants' claims or "a security system 
providing multiple protocol layer security in said storage area network". Instead, Lee lists 
a RAM memory which is a standard memory component in any modern computer and is a very 
different matter altogether from applicant's Security system for a storape area network 
providing multiple protocol layer security in the storage area network . Further, if the 
storage area network security and multiple protocol layer security in storage area network 
elements are considered by the Examiner to be inherent in Lee, applicant respectfully requests 
the introduction of extrinsic evidence clearly showing that the omitted material is necessarily 
present in Lee and that it would be so recognized by persons of ordinary skill. In this regard, 
see In re Robertson , 49 USPQ2d 1949 (Fed. Cir. 1999). Alternatively, applicant respectfully 
requests withdrawal of this rejection. 

Claims 20-25, 32, 39, 53-54, and 61, depending from allowable claims 2, 31, 52, are 
also allowable for the same reasons stated above. 

Applicant can also provide detailed description on various other elements of the claims 
that are also not taught, disclosed or illustrated by Lee if the Examiner requires it. 

Independent Claims 1, 26, 27, 28, 50, 62: 

Claims 1, 26, 27, 28, 50 and 62 have been amended and no new matter has been 
added as described below. 

Claims 1 , 26, 27, 28, 50 and 62 have been amended to include "a distributed network 
security system comprising" in place of "a security system comprising". That is, the security 
system of applicant's invention is a distributed network security system to signify the distributed 
network security system described in this patent application titled "A distributed network 
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security system and a hardware processor thereof which may be appreciated to be clear and 
concise by any person skilled in the art and may be appreciated by the Examiner. The claims 
have further been amended from "said network comprising one or more networked systems" to 
"said network comprising distributed security systems and one or more networked 
systems, said distributed security systems each comprising at least one host processor". 
That is, the network that is being secured by applicant's invention of distributed network security 
system comprises of distributed security systems along with other networked systems instead of 
a single security system securing an internal network from attacks from an external network as 
described on page 2 lines 8-18, page 4 line 31 through page 6 line 22, page 61 line 13 through 
page 63 line 23 and page 12 lines 6-29 in clear, concise and exact terms as may be appreciated 
by a person with ordinary skill in the art. Further, the claims have been amended to substitute 
"said one or more networked systems" with "said distributed security systems providing 
multiple protocol layer security". That is, the distributed security systems of applicant's 
invention provide security at multiple protocol layers of the protocol stack as described on page 
6 lines 4-14, page 20 lines 20-29, page 20 lines 10-19 in clear, concise and exact terms as may 
be appreciated by a person with ordinary skill in the art. Further the claims have been amended 
to substitute "comprising a hardware processor providing" with "comprising a hardware 
processor offloading or accelerating or sharply reducing overhead of. That is, the 
hardware processor of applicant's invention offloads or sharply reduces overhead of or 
accelerates the protocol processing stack from a host processor of the distributed security 
systems as indicated in lines 20-25 of page 2, lines 24-28 of page 61 through lines 1-2 of page 
62, lines 10-11 of page 8, lines 16-20 of page 13, lines 10-15 of page 14, lines 20-22 and lines 
30-32 of page 16 through lines 1-5 of page 17, lines 17-23 of page 20, lines 18-20 of page 17, 
as well as lines 18-32 of page 18. The claims have been further amended by adding the term 
"distributed network" to signify the distributed network security system described in this patent 
application titled "A distributed network security system and a hardware processor thereof 
which may be appreciated to be clear and concise by any person skilled in the art and may be 
appreciated by the examiner. 

Nowhere in Lee is a "distributed network security system comprising a network 
comprising distributed security systems" described or suggested. Also, nowhere in Lee are 
"distributed security systems providing multiple protocol layer security" described or 
suggested. Further, nowhere in Lee are "distributed security systems comprising a hardware 



SA\8069584.3 
CONFIDENTIAL003533 



28 



Appl. No.: 10/783,890 
Docket No.: 352612-991180 
Proposed Amendment 

processor offloading or accelerating or sharply reducing overhead of transport layer 
protocol processing from at least one host processor of the said distributed security systems" 
described or suggested. 

First, the Examiner has stated "Lee teaches a security network system (see figures 1, 
with emphasis added) comprising one or more network systems of one or more types (see Fig. 
1 with emphasis added)". Applicant agrees with the Examiner that Lee teaches a firewall for 
real-time internet application stated in Lee in col. 4 line 16 as "Hybrid firewall 100 is placed 
between internal IP network 110 and external IP network 120, thereby protecting internal IP 
network 110 from attack from the outside". Lee's firewall system is a perimeter security system 
described to be inadequate or insufficient in applicant's patent application because majority of 
security threats come for within an internal network and a perimeter security system like Lee's 
does not protect against such attacks as described in applicant's application on page 2 lines 8- 
18, page 4 line 31 through page 5 line 11 and page 61 lines 13-17. However applicant's 
distributed network security system protects against external and internal attacks unlike one 
"firewall" system described in Lee that protects an internal network from attacks from outside. 
Hence applicant asserts that Lee does not teach a "security system comprising a network " as 
asserted by the Examiner but instead only shows one firewall system that secures systems in 
an internal network from attacks from an external network and even if the Examiner considers 
otherwise, Lee certainly does not teach "a distributed network security system" as required 
by the applicant's amended claims discussed above. 

Second, the Examiner has also stated that: "The firewall 100 comprises packet filter 106 
(hardware processor) that examine packets (emphasis added)". Applicant respectfully 
disagrees with the Examiner on this assertion. In fact Lee clearly states in lines 4-8 col. 8 that: 
"Application proxy 102, control logic 104, packet filter 106 and NAT 108 (as illustrated in Fig. 1) 
are stored in hard disk and executed on workstation motherboard 202 through the use of 
processor 204, RAM memory 206 and DMA controller 208". As may be appreciated by any 
person with ordinary skill in the art that the packet filter 106, along with other elements 
described above are in fact software programs that are "stored in hard disk' and "executed 
on workstation motherboard' and obviously cannot be hardware processors that get stored 
inside hard disk and executed on the workstation motherboard. Thus, Lee does not teach or 
describe a hardware processor providing transport layer protocol processing. However, even if 
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the examiner considers this otherwise, Lee certainly does not teach or describe "a hardware 
processor offloading or accelerating or sharply reducing overhead of transport layer 
protocol processing from at least one host processor of said distributed security 
systems" as required by applicant's amended claims discussed above. 

Accordingly, Lee does not explicitly teach, disclose, or illustrate " A distributed network 
security system comprising a network " and "said network comprising distributed security 
systems and one or more networked systems of one or more types" and "distributed security 
systems providing multiple protocol layer security' and "a hardware processor offloading or 
accelerating or sharply reducing overhead of transport layer protocol processing from at 
least one host processor of said distributed security systems" and "said distributed network 
security system providing multiple protocol layer security in said network' elements of 
applicant's claims as amended and described above. Further, if these claim elements are 
considered by the Examiner to be inherent in Lee, applicant respectfully requests the 
introduction of extrinsic evidence clearly showing that the omitted material is necessarily present 
in Lee and that it would be so recognized by persons of ordinary skill. In this regard, see In re 
Robertson , 49 USPQ2d 1949 (Fed. Cir. 1999). Alternatively, applicant respectfully requests 
withdrawal of this rejection. 

Claims 3-8, 17, 19, 29, 30, and 33 depending from allowable claims 1, 26, and 28, are 
also allowable for the same reasons stated above. 

Applicant can also provide detailed description on various other elements of the claims 
that are also not taught, disclosed or illustrated by Lee if the Examiner requires it. 

Third Rejection of Office Action 

Claim 51 was rejected under 35 USC §1 03(a) as being unpatentable over Lee in view of 
Kametani (U.S. Patent 6,839,346 B1). 

Claim 51 has been amended and no new matter has been added as described below. 

Claim 51 has been amended to include "a distributed network security system 

comprising" in place of "a security system comprising". That is, the security system of 
applicant's invention is a distributed network security system to signify the distributed network 
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security system described in this patent application titled "A distributed network security 
system and a hardware processor thereof which may be appreciated to be clear and concise 
by any person skilled in the art and may be appreciated by the Examiner. The claim has further 
been amended from "said network comprising one or more networked systems" to "said 
network comprising distributed security systems and one or more networked systems 
said distributed security systems each comprising at least one host processor". That is, the 
network that is being secured by the applicant's invention of distributed network security system 
comprises of distributed security systems along with other networked systems instead of a 
single security system securing an internal network from attacks from an external network as 
described on page 2 lines 8-18, page 4 line 31 through page 6 line 22, page 61 line 13 through 
page 63 line 23 in clear, concise and exact terms as may be appreciated by a person with 
ordinary skill in the art. Further, the claim has been amended to substitute "said one or more 
networked systems" with "said distributed security systems providing multiple protocol 
layer security". That is, the distributed security systems of applicant's invention provide 
security at multiple protocol layers of the protocol stack as described on page 6 lines 4-14, page 
20 lines 20-29, page 20 lines 10-19 in clear, concise and exact terms as may be appreciated by 
a person with ordinary skill in the art. Further the claim has been amended to substitute 
"comprising a hardware processor providing" with "comprising a hardware processor 
offloading or accelerating or sharply reducing overhead of. That is, the hardware 
processor of applicant's invention offloads or sharply reduces overhead of or accelerates the 
protocol processing stack from a host processor of the distributed security systems as indicated 
in lines 20-25 of page 2, lines 24-28 of page 61 through lines 1-2 of page 62, lines 10-11 of 
page 8, lines 16-20 of page 13, lines 10-15 of page 14, lines 20-22 and lines 30-32 of page 16 
through lines 1-5 of page 17, lines 17-23 of page 20, lines 18-20 of page 17, as well as lines 18- 
32 of page 18. The claim has been further amended by adding the term "distributed network' 
to signify the distributed network security system described in this patent application titled "A 
distributed network security system and a hardware processor thereof which may be 
appreciated to be clear and concise by any person skilled in the art and may be appreciated by 
the examiner. 

As to claim 51 , the Examiner stated that: 

"In claim 51, Lee has disclosed most of limitations in claim 1. Lee 
does not disclose a security processing engine performing 
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encryption, decryption, authorization or authentication. Kametani 
discloses, in fig. 2, a security process including a security 
processing section 19. The security section 19 is instructed to 
encrypt, decrypt packets (security processing engine performing 
encryption, decryption; see Col. 8, lines 40-45). Therefore, it 
would have been obvious to one ordinary skilled in the art to use 
the encrypt/decrypt method of Kametani into Lee in order to 
transmit confidential information to receiver". 

Nowhere in Lee or Kametani is a "distributed network security system comprising a 
network comprising distributed security systems" described or suggested. Also, nowhere 
in Lee or Kametani are "distributed security systems providing multiple protocol layer 
security" described or suggested. Further, nowhere in Lee or Kametani are "distributed 
security systems comprising a hardware processor offloading or accelerating or sharply 
reducing overhead of transport layer protocol processing from at least one host processor 
of said distributed security systems" described or suggested. 

Accordingly, to the extent that Kametani discloses encryption/decryption method, neither 
Lee nor Kametani explicitly teaches, discloses, or illustrates each and every element of claim 
51. Further, applicant respectfully asserts that the combination of Lee and Kametani together 
fails to disclose or suggest all elements of claim 51. Hence, it would not have been obvious to 
one of ordinary skill in the art at the time the invention was made to have combined these two 
inventions and arrive at all the features disclosed in claim 51. 

Further, if each of the missing element of claim 51 is considered by the Examiner to be 
inherent in the combination of Lee and Kametani, applicant respectfully requests the 
introduction of extrinsic evidence clearly showing that the omitted material is necessarily present 
in the combination of Lee and Kametani and that it would be so recognized by persons of 
ordinary skill. In this regard, see In re Robertson , 49 USPQ2d 1949 (Fed. Cir. 1999). 
Alternatively, applicant respectfully requests withdrawal of this rejection. 

In view of these remarks, it is submitted that the claims of this application are patentably 
distinct from the references of record. Applicant asserts that all claims are allowable and 
requests that the above rejections be withdrawn and the claims be passed to issue. 
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The Commissioner is hereby authorized to charge any additional fees or credit any 
overpayment that may be associated with this communication to Deposit Account No. 07-1896 
referencing Attorney Docket No. 352612-991180. 



DLA PIPER US LLP 

2000 University Avenue 

East Palo Alto, CA 94303-2248 

Attn: Patent Docketing Department 

Telephone: (916) 930-3239 

Facsimile: (916)930-3201 
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